diff --git a/.cloudbuild/reads.cloudbuild.yaml b/.cloudbuild/reads.cloudbuild.yaml
index 47bfc7537..a1159b737 100644
--- a/.cloudbuild/reads.cloudbuild.yaml
+++ b/.cloudbuild/reads.cloudbuild.yaml
@@ -9,6 +9,7 @@ steps:
         'deploy/dockerfiles/reads/reads-server.dockerfile',
         '.',
       ]
+
   - name: 'gcr.io/cloud-builders/docker'
     args:
       [
@@ -19,7 +20,18 @@ steps:
         'deploy/dockerfiles/reads/auth.dockerfile',
         '.',
       ]
-# TODO: commented out for testing without push
-# images:
-#   - 'us-docker.pkg.dev/$PROJECT_ID/gnomad/gnomad-reads-server:$SHORT_SHA'
-#   - 'us-docker.pkg.dev/$PROJECT_ID/gnomad/gnomad-reads-api:$SHORT_SHA'
+
+  - name: 'gcr.io/cloud-builders/docker'
+    args: ['push', 'us-docker.pkg.dev/$PROJECT_ID/gnomad/gnomad-reads-server:$SHORT_SHA']
+
+  - name: 'gcr.io/cloud-builders/docker'
+    args: ['push', 'us-docker.pkg.dev/$PROJECT_ID/gnomad/gnomad-api-server:$SHORT_SHA']
+
+images:
+  - 'us-docker.pkg.dev/$PROJECT_ID/gnomad/gnomad-reads-server:$SHORT_SHA'
+  - 'us-docker.pkg.dev/$PROJECT_ID/gnomad/gnomad-reads-api:$SHORT_SHA'
+
+availableSecrets:
+  secretManager:
+    - versionName: projects/$PROJECT_ID/secrets/GITHUB_DEPLOY_KEY/versions/latest
+      env: 'DEPLOY_KEY'